mrstrong

Hi, I've noticed that all our PCs have a default list of local administrators. This has been done via group policy: the GPO is linked at the domain so effects all OUs and uses "Restricted Groups" with just one group: Administrators. Looking at it's properties I see under "Members of this group" a list of users/groups. I need more fine grained control and am not sure on the best way to approach it? If I delete this "Restricted Groups" setting from the GPO which applies at the domain level what will happen ? Will local admins revert to whatever they where previously on each PC or will they just stay as is? Should I set "Restricted Groups" via another GPO at a lower level OU e.g. using inheritance ? Thanks

thanks, out of interest how do you go about making the msi's ?

deleted all four and seemed to do the trick with no adverse effects

Maybe old thread but was top result in my search. Just found this bang up to date version of notepad++ msi : Notepad++ MSI package for Enterprise deployment is available | Hass

Our users seem to have several $Recycle.bin folders e.g. for the home folder Z: we have four recycle bins under Z:\ Z:\My Music Z:\My Pictures Z:\My Videos Is this normal ? I guess I need to delete all four to clean up ?

thanks, gave up in the end and installed manually. Will look into it when more time

I'm trying to roll out an old 6 version: java version "1.6.0_37" Java™ SE Runtime Environment (build 1.6.0_37-b06) Java HotSpot™ Client VM (build 20.12-b01, mixed mode, sharing)

vanilla ? under time pressure here as java needed by tomorrow and still got a million and one other things to do as well. If it comes to it I can manually install as a temp fix (assuming that wouldn't mess up with app assignment in GPO ?)

So I followed jamesfed's excellent guide to install java http://www.edugeek.net/forums/enterprise-software/111305-deploying-adobe-reader-adobe-flash-java-msi-gpo-guides.html All looked good, Java appears in "Programs and Features" as an installed program. However when I run from java from cmd it's not found and a quick search reveals there is no java.exe on the PC ! I ran the msi manually (changes saved in the msi rather than a separate transform) from the server share and it said it was already installed and did I want to re-install. Clicked yes and it removed it! Nice touch. So ran msi again and this time was installed ok So went round some other PC's and uninstalled java. then did a gpupdate / force and rebooted. Nothing seemed to happen i.e. no messages about installing software. Logged in and sure enough java not installed Then went to GPMC and did a group policy results wizard which shows no issues e.g. java install GPO applied ok but I know it's not !? Any ideas on troubleshooting this further ? Thanks

Only actually rolled out Michael's reg fix (post #23) Tested the local machine idea on one PC with regedit e.g. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxySettingsPerUser"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxyEnable"=dword:00000001 "ProxyServer"="proxy:port" "ProxyOverride"="192.168.0.*;etc;" Seems to work but some users have the option to untick the proxy in IE whilst for others it is greyed out which is odd?

How would you do this ? A quick google suggested: Then add your 3 registry values e.g. but this time under And this would still allow a user to untick "use proxy server" in IE LAN settings e.g. if they take a laptop off site and need to change / disable the proxy ?

Michael reg fix (post #23) working for me on win 7 IE10 with server 2008 R2 Couple of Qs: If later some users are moved out of GPO scope will the registry changes be backed out ? Is there a way of setting proxy per machine in registry so I could link to OU with computer accounts ? Seem to recall you can simulate this with loopback policy ? Finally my win 7 machine got updated to IE10 and I found that when using GPMC (via RSAT) the Internet Explorer Maintenance (IEM) settings can not be edited in the GPO even though they are still there! I went back to IE9 and the IEM settings re-appeared Quick way to roll back IE10 to IE9 from admin cmd: wusa /uninstall /kb:2718695 /quiet /forcerestart PS Isn't it nice and quite without the teachers / kids (strike day). Actually getting some stuff done!

For what it's worth I'm always seeing "the trust relationship between this workstation and the primary domain failed" happens on average on 1 pc per 100 pcs every month (rough estimate ) All machines are done via sysprep I'm getting so quick at running the network ID wizard to join it back to domain I haven't even bothered to try and find a script to fix.

Hi TechSupp / MordyT could you give more details as I'm trying to create an image in virtualbox, At the moment I've got win 7 installed in a vm, not on the domain and with guest additions, my plan is now to take a snapshot, sysprep, and capture. Do I need an unattend.xml created from WSIM ? I was just looking at a post from Michael where he uses mysysprep2 http://www.edugeek.net/forums/windows-7/72811-auto-join-domain-using-sysprep-windows-7-a-3.html

Thanks, a simple search in windows explorer (top right) shows me a lot of filenames in the recyle bin. e.g. path\username\RECYCLER\S-1-5-21-nnnnnn-nnnnnnnn-nnnnnnn-nnnnnnn\file Was looking for a way to restrict to just folders, and found I can add this to the query kind:folders which is nice, see Advanced Query Syntax Advanced Query Syntax (Windows) This turns up lots of folders like path\username\RECYCLER So I guess it's these "RECYCLER" folders I need to delete ?

Hi, I'm redirecting "my documents" for users with "other folders follow my documents". As I understand it this means each user has their own recycle bin on the server e.g. \server\homeshare\fred\$recyle.bin where stuff they delete from their my documents goes? Is there an easy way to clear all these in one fell swoop ?

I'm trying to clean up a shared folder. Basically want to delete all pictures and videos over say 1 year old. Would like to run with "no teeth" first e.g. a report showing what will be deleted so I can check through it first. Also need an electronic copy (e.g. .txt or .xls) of what has been deleted for records and so I can get it back off backup if (/when!) required. Any ideas on scripts / free utils to do the job ?

thanks, just fixed another one with only 3 changes so to summarize here's what was changed via secpol.msc under Security Settings->Local Policies->Security Options Might help some other poor sod Microsoft network client: Digitally sign communications (always) Disabled Network security: LAN Manager authentication level Send LM & NTLM - use NTLMv2 session security if negotiated Network security: Minimum session security for NTLM SSP based (including secure RPC) clients Require 128-bit encryption

Nothing clever: just ran secpol.msc locally on a bad client and changed the settings manually. Only seen a few bad clients so far so a manual fix won't be too onerous. You've got me thinking though, is there a more efficient way to roll this out to all clients, e.g. can it be done via group policy or a startup script that loads the registry values? And is there an easy way to identify which registry entries relate to specific secpol.msc settings ?

Hi, yes was one of the first things I tried but it was not enough on it's own. Actually on a working client I had Network security: LAN Manager authentication level Not Defined I.e. no registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel Looks like the security options on the bad client have been changed from the defaults (though not sure how?!) as the bad client was imaged from a working client. Found this article on how to reset them How to reset all Windows 7 or Vista Security settings to its default values But then read How do I restore security settings to a known working state? which says that method is not supported on vista upwards: so decided to just change manually to match a working client Made changes one at a time with a reboot after each change: Network security: Minimum session security for NTLM SSP based (including secure RPC) clients Require 128-bit encryption Network security: Minimum session security for NTLM SSP based (including secure RPC) servers Require 128-bit encryption Network access: Do not allow anonymous enumeration of SAM accounts and shares Disabled Then after this change everything starts working: Microsoft network client: Digitally sign communications (always) Disabled Some other differences e.g. Microsoft network server: Digitally sign communications (always) was Enabled when default says should be disabled but not relevant in this client scenario. Annoying the MS net command didn't give me a good error message but at least I've learnt a bit and got it working in the end Thanks

Think I've found it manually changed all "local policies -> security options" via secpol.msc on a bad client to match those on a good client and what do you know ? net view \\NAS now working like a good 'un! MS son of a ... About 10 diffs and needed a reboot to pick up so not sure which one(s) did the trick. Will investigate some more and post back

Hi, thanks for the info which is very interesting. Unfortunately it doesn't fix my issue. I get the same error with \\name and \\IP Plus already tried send LM and send LM & NTLM only Was thinking of re-installing "client for microsoft networks" but on a netbook so no drive for windows dvd.

mac_shinobi: tcp reset didn't work ... but looking again in the event logs there are some suspicious entries. Event ID 5719 Source NETLOGON Google brings up loads of stuff on this I'm thinking maybe it's ok e.g. from reading "More information" at Event ID 5719 is logged when you start a computer Event ID 1001 Source Dhcp-Client Again this is ok I think as ipconfig shows I have got a valid IP and all other networking seems to work fine, just can't connect to QNAP. I tried running gpupdate and in the logs I can see: Event ID 4321 Source NetBT The name "our-domain-name :1d" could not be registered on the interface with IP address laptops-ip-address. The computer with the IP address QNAPs-ip-address did not allow the name to be claimed by this computer. And finally a Event ID 1030 Source GroupPolicy Not sure if this could be the issue ? Checked the clocks are set fine. I'll take a look at the hotfix, thanks.

Thanks mac_shinobi, I'll give that a try

Looking in event logs found error about virtualbox guest additions so uninstalled as not needed (was left in the original PC image). Is it possible the windows network software could have been messed up by this ? Ipconfig is showing several disconnected adapters (and one working wireless LAN adapter) E.g. "Tunnel adapter" "Tunnel adapter isatap" Is there a way to reinstall just "microsoft networking" e.g. the TCP/IP stack components? May be worth a try ?